diff --git a/.github/workflows/kilo-app-ci.yml b/.github/workflows/kilo-app-ci.yml
index 38263859a6..64296566ec 100644
--- a/.github/workflows/kilo-app-ci.yml
+++ b/.github/workflows/kilo-app-ci.yml
@@ -37,7 +37,6 @@ concurrency:
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   typecheck:
diff --git a/.kilo_workflow/dispatch-role.sh b/.kilo_workflow/dispatch-role.sh
index 2ee341769d..1093f46eae 100755
--- a/.kilo_workflow/dispatch-role.sh
+++ b/.kilo_workflow/dispatch-role.sh
@@ -52,6 +52,11 @@ fi
 if [ "$ROLE" = "e2e-verifier" ] || [ -z "$CALLER_SESSION" ]; then
   tmux new-session -d -s "$NAME" "$CMD"
 else
-  tmux new-window -d -t "$CALLER_SESSION" -n "$NAME" "$CMD"
+  # Trailing colon pins the target to <session>:<auto-index>. Without it tmux
+  # prefix-matches the session name against WINDOW names first, and a session
+  # named <section> collides with the planner/orchestrator window named
+  # <section>-planner — new-window then fails with "create window failed:
+  # index N in use" (see learnings/tmux-new-window-index-in-use-name-prefix-collision.md).
+  tmux new-window -d -t "$CALLER_SESSION:" -n "$NAME" "$CMD"
 fi
 echo "$LOG"
diff --git a/.kilo_workflow/learnings/tmux-new-window-index-in-use-name-prefix-collision.md b/.kilo_workflow/learnings/tmux-new-window-index-in-use-name-prefix-collision.md
new file mode 100644
index 0000000000..b154b4d1dc
--- /dev/null
+++ b/.kilo_workflow/learnings/tmux-new-window-index-in-use-name-prefix-collision.md
@@ -0,0 +1,20 @@
+# tmux new-window fails "create window failed: index N in use" — session/window name prefix collision
+
+Symptom: `dispatch-role.sh` (or any `tmux new-window -t <session> -n <name> ...`) fails with
+`create window failed: index 1 in use` even though the session obviously has free window indexes.
+Reproduced on tmux 3.7b: a plain `tmux new-window -d -t <session> -n probe "sleep 5"` fails the
+same way while `-t <session>:2` (explicit index) and `-t <session>:` (trailing colon) both work.
+
+Cause: tmux target parsing prefix-matches the target against **window names** before falling back
+to the session. The workflow names sessions `<section>` and windows `<section>-<role>` /
+`<section>-planner`, so `-t <section>` prefix-matches the planner window (index 1) and tmux tries
+to create the new window *at that window's index*, which is taken. Runs whose session name differs
+from every window-name prefix (e.g. session `kilo-dev-<section>`) never see it, which is why some
+concurrent workflows kept working on the same server.
+
+Fix: target `<session>:` (trailing colon = session with an empty window part → next free index),
+which is unambiguous. `dispatch-role.sh` does this; keep the colon. If you hit the symptom
+manually, use `-t <session>:` or an explicit free index. Diagnosis recipe: probe with
+`tmux new-window -d -t <session> -n probe "sleep 5"`, then compare
+`tmux list-windows -t <session> -F '#{window_index} #{window_name}'` for a window whose name
+starts with the session name.